Data Processing Addendum

For customers who need one. Last updated 2026.

Lockbox Mail acts as a processor of personal data that you, the controller, place in the service. We process it only to provide the service and on your documented instructions; apply the technical and organizational measures described on the Security page (encryption at rest and in transit, two-factor authentication, access logging, least-privilege operations); engage only the subprocessors listed, and give you 30 days' notice of any change; assist with data-subject requests and breach notification without undue delay and in any case within 72 hours of becoming aware; and delete or return all personal data at the end of the service as you direct. Where data is transferred out of its region, standard contractual clauses apply. This addendum forms part of the Terms of Service.